working session controller, password processing to be improved